A technique to stop lateral movement of ransomware between endpoints in a vlan is disclosed. A security appliance is set as the default gateway for intra-LAN communication. message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. compromised devices may be quarantined.
|
13. A virtual local area network (vlan) system, comprising:
a vlan apparatus of a vlan access or trunk port, the vlan apparatus including a security appliance configured as a default gateway for intra-vlan communication of a plurality of endpoint devices using a subnet mask of 255.255.255.255;
the security appliance configured to monitor intra-vlan message traffic, allow only authorized intra-vlan communication and detect lateral propagation of ransomware between endpoint devices via intra-vlan communication in a shared vlan environment.
1. A computer-implemented method of ransomware protection in a virtual local area network (vlan), comprising:
deploying a security appliance in an access or a trunk port of a shared vlan environment;
using a subnet mask of 255.255.255.255 to set the security appliance as a default gateway for a plurality of endpoint devices of the shared vlan environment;
monitoring, by the security appliance, intra-vlan communication between the plurality of endpoint devices of the shared vlan environment; and
detecting, by the security appliance, lateral propagation of ransomware between endpoint devices via intra-vlan communication in the shared vlan environment.
12. A computer program product for ransomware protection in a virtual local area network (vlan) comprising computer program instructions, which when executed on a processor implement a method, comprising:
deploying a security appliance in an access or trunk port of a shared vlan environment;
using a subnet mask of 255.255.255.255 to set the security appliance as a default gateway for a plurality of endpoint devices of the shared vlan environment;
monitoring, by the security appliance, intra-vlan communication between the plurality of endpoint devices of the shared vlan environment; and
detecting, by the security appliance, lateral propagation of ransomware between endpoint devices via intra-vlan communication in the shared vlan environment.
18. A computer-implemented method of ransomware protection in a virtual local area network (vlan), comprising:
deploying a security appliance in an access or a trunk port of a shared vlan environment;
using a subnet mask of 255.255.255.255 to set the security appliance as a default gateway for a plurality of endpoint devices of the shared vlan environment;
monitoring, by the security appliance, intra-vlan communication between the plurality of endpoint devices of the shared vlan environment;
detecting, by the security appliance, attributes of intra-LAN messages indicative of lateral propagation of ransomware between endpoint devices via intra-vlan communication in the shared vlan environment;
identifying attempts by individual endpoint devices to circumvent the security appliance by identifying response messages passing through the security appliance not having corresponding request messages;
allowing, by the security appliance, only authorized communication between the plurality of endpoint devices of the shared vlan environment; and
quarantining an endpoint device compromised by ransomware by blocking intra-vlan communication of the compromised endpoint device.
2. The computer-implemented method of
3. The computer-implemented method of
4. The computer-implemented method of
5. The computer-implemented method of
6. The computer-implemented method of
7. The computer-implemented method of
8. The computer-implemented method of
9. The computer-implemented method of
10. The computer-implemented method of
11. The computer-implemented method of
15. The vlan system of
17. The vlan system of
19. The computer-implemented method of
20. The computer-implemented method of
21. The computer-implemented method of
|
The present disclosure generally relates to techniques for ransomware protection. More particularly, the present disclosure is related to providing lateral movement protection from Ransomware in environments such as shared VLAN environments.
Ransomware is one of the biggest threats facing the security industry today. Ransomware is a form of malware that infects computer systems. Ransomware is becoming an increasing problem in the computer/network security industry. Ransomware infects a computer system and encrypts files. A ransom is demanded in exchange for a decryption key.
Conventional enterprise security solutions have proved to be inadequate in view of the high profile ransomware cases of large companies such as the Colonial Pipeline ransomware attack in 2021. The inadequacy of conventional enterprise security solutions is also evidenced by the fact that in 2020 51% of surveyed companies were hit by ransomware attacks.
Firewalls provide inadequate protection against ransomware attacks. In some companies, separate Virtual Local Area Networks (VLANs) are used to segment sections of a company by division as an additional layer of protection. For example, a finance department may have a separate VLAN domain than an engineering department. Or a finance department may have a different VLAN domain than a marketing department. However, this sort of segmentation of VLAN domains by departments doesn't address the problem of lateral movement of Ransomware attacks within a VLAN domain.
One of the reasons for the inadequacy of current enterprise security solutions is the difficulty of protecting against ransomware attacks within a shared VLAN based network architecture. If a device that is part of a shared VLAN broadcast domain is infected by ransomware or malware, there are very few security controls that can be implemented to prevent lateral propagation of the ransomware within the same VLAN network.
Referring to
Current security solutions for lateral propagation protection of ransomware are based on endpoint protection. The drawback of these approaches is that it relies on an agent deployed on each endpoint to detect malicious ransomware processes being launched. Deploying and managing these agents is a challenge for IT organizations, and furthermore they cannot be deployed on IoT devices (such as web cameras, printers, and other devices) and are frequently not supported on older versions of operating systems.
Conventional VLAN network architectures have a potential gap in protection associated with lateral movement of ransomware between endpoint devices. Software application on endpoint devices provides only limited protection due to a variety of practical problems in managing software apps on endpoint devices and the presence of other IoT devices at endpoint devices, such as web cameras, printers, etc. There is thus a potential for ransomware to enter the VLAN network and laterally propagate to endpoint devices.
A technique to detect lateral propagation of ransomware between endpoints in a VLAN is disclosed. In one implementation, a smart appliance is deployed in an access port or a trunk port of VLAN network. The smart appliance is set as the default gateway for intra-LAN communication for two or more endpoint devices. Message traffic from compromised endpoints is detected.
Additional measures may also be taken to generate alerts or quarantine compromised end point devices.
An example of a computer-implemented method of ransomware protection in a Virtual Local Area Network (VLAN) includes deploying a security appliance in an access or a trunk port of a shared VLAN environment. A subnet mask of 255.255.255.255 is used to set the security appliance as a default gateway for a plurality of endpoint devices of the shared VLAN environment. The security appliance monitors intra-VLAN communication between the plurality of endpoint devices of the shared VLAN environment. The security appliance detects lateral propagation of ransomware between endpoint devices via intra-VLAN communication in the shared VLAN environment.
It should be understood, however, that this list of features and advantages is not all-inclusive and many additional features and advantages are contemplated and fall within the scope of the present disclosure. Moreover, it should be understood that the language used in the present disclosure has been principally selected for readability and instructional purposes, and not to limit the scope of the subject matter disclosed herein.
The present disclosure is illustrated by way of example, and not by way of limitation in the figures of the accompanying drawings in which like reference numerals are used to refer to similar elements.
In one implementation, virtual point to point links between a security appliance 150 and each endpoint 120 are established in a shared VLAN domain that forces all traffic from an endpoint to traverse the security appliance 150. In one implementation, the security appliance is deployed on an access port or a trunk port on an existing router or switch.
In one implementation, the security appliance 150 becomes the default gateway and the Dynamic Host Configuration Protocol (DHCP) server responsible for dynamically assigning an IP address and other network configuration parameters to each endpoint device on the network so that they communicate with each other in the existing VLAN network.
When an individual endpoint 120 requests an IP address, the security appliance 150 responds back with an IP address and a subnet mask that sets the security appliance as the default gateway for the endpoint. In one implementation, the security appliance responds with a subnet comprised of all ones—255.255.255.255—that sets itself as the default gateway for the endpoint. Since the endpoint receives an IP address with a subnet mask of 255.255.255.255, any network communication with other endpoints or internet applications needs to be routed via the default gateway. In other words, a network with a subnet mask of 255.255. 255.255 puts each device inside its own subnet, which forces them to communicate with the default gateway before communicating with any other device. The 255.255. 255.255 subnet mask may also be referred to by the Classless Inter-Domain Routing (CIDR) prefix /32, which has 1 IP address. The CIDR number comes from the number of ones in the subnet mask when converted to binary. The 255.255.255.255 subnet mask corresponds to a CIDR prefix of /32.
Since the security appliance 150 sets itself as the default gateway for the network (by virtue of the subnet mask being comprised of all ones), any East-West communication between different endpoints 120 and communication between an endpoint 120 and other endpoints 120 or applications on different networks will be routed via it. This provides the security appliance with the unique ability to allow only authorized communication and disallow everything else.
In the example of
It will be understood that while the security appliance 150 may be deployed on an existing VLAN system, in some implementations it may also be incorporated into new VLAN system components, such as being incorporated into an access port or a trunk port.
From the perspective of the endpoint 120, other endpoints and applications appear to be in a different IP network. Hence all outbound packets are sent to the default gateway as shown in
Regardless of how the compromised endpoint became infected with ransomware, the security appliance 150 was earlier set as the default gateway. The security appliance 150 monitors message traffic and quarantines suspicious traffic from the compromised endpoint to other endpoints. This may include, for example, detecting message traffic that has attributes associated with ransomware, such as computer code for file scanning or encryption. It may also optionally include, in some implementations, detecting that message traffic that is unusual in comparison to a baseline profile of normal message traffic.
It is possible that ransomware in a compromised endpoint may attempt to directly communicate with another endpoint and bypass the security appliance 150. However, such an attempt to circumvent the security appliance 150 may still be detected and prevented.
The security appliance 150 restricts communication in a manner that significantly reduces the attack surface available to the ransomware to exploit vulnerabilities in other endpoints and/or applications and propagate laterally. It detects attempts to circumvent the protection provided by the security appliance. If a compromised endpoint attempts to bypass the default gateway and tries to laterally propagate to another device, this attempt would be detected by the security appliance and appropriate action would be taken. This detection is because the uncompromised endpoint would still send the response packets to the compromised endpoint via the security appliance 150 (due to the /32 default route). The security appliance 150 detects the fact that it has seen a response packet to a request sent by the compromised endpoint, and it alerts the operator in this case. Automatic actions may be taken by the security appliance 150 including quarantining the compromised endpoint so that further lateral propagation is impossible.
Other implementations of one or more of these aspects include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.
These and other implementations may each optionally include one or more of the following features.
In the above description, for purposes of explanation, numerous specific details were set forth. It will be apparent, however, that the disclosed technologies can be practiced without any given subset of these specific details. In other instances, structures and devices are shown in block diagram form. For example, the disclosed technologies are described in some implementations above with reference to user interfaces and particular hardware.
Reference in the specification to “one embodiment”, “some embodiments” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least some embodiments of the disclosed technologies. The appearances of the phrase “in some embodiments” in various places in the specification are not necessarily all referring to the same embodiment.
Some portions of the detailed descriptions above were presented in terms of processes and symbolic representations of operations on data bits within a computer memory. A process can generally be considered a self-consistent sequence of steps leading to a result. The steps may involve physical manipulations of physical quantities. These quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. These signals may be referred to as being in the form of bits, values, elements, symbols, characters, terms, numbers, or the like.
These and similar terms can be associated with the appropriate physical quantities and can be considered labels applied to these quantities. Unless specifically stated otherwise as apparent from the prior discussion, it is appreciated that throughout the description, discussions utilizing terms, for example, “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, may refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
The disclosed technologies may also relate to an apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may include a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer.
The disclosed technologies can take the form of an entirely hardware implementation, an entirely software implementation or an implementation containing both software and hardware elements. In some implementations, the technology is implemented in software, which includes, but is not limited to, firmware, resident software, microcode, etc.
Furthermore, the disclosed technologies can take the form of a computer program product accessible from a non-transitory computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer-readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
A computing system or data processing system suitable for storing and/or executing program code will include at least one processor (e.g., a hardware processor) coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code to reduce the number of times code must be retrieved from bulk storage during execution.
Input/output or I/O devices (including, but not limited to, keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems and Ethernet cards are just a few of the currently available types of network adapters.
Finally, the processes and displays presented herein may not be inherently related to any particular computer or other apparatus. Various general-purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct a more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the disclosed technologies were not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the technologies as described herein.
The foregoing description of the implementations of the present techniques and technologies has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the present techniques and technologies to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the present techniques and technologies be limited not by this detailed description. The present techniques and technologies may be implemented in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, routines, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the present techniques and technologies or its features may have different names, divisions and/or formats. Furthermore, the modules, routines, features, attributes, methodologies and other aspects of the present technology can be implemented as software, hardware, firmware or any combination of the three. Also, wherever a component, an example of which is a module, is implemented as software, the component can be implemented as a standalone program, as part of a larger program, as a plurality of separate programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future in computer programming. Additionally, the present techniques and technologies are in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Accordingly, the disclosure of the present techniques and technologies is intended to be illustrative, but not limiting.
Mohan, Satish M., Agrawal, Ritesh R., Adavi, Vinay
Patent | Priority | Assignee | Title |
11695799, | Jun 24 2021 | AIRGAP NETWORKS INC. | System and method for secure user access and agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links |
11711396, | Jun 24 2021 | AIRGAP NETWORKS INC. | Extended enterprise browser blocking spread of ransomware from alternate browsers in a system providing agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links |
11714907, | Mar 09 2021 | WatchPoint Data, Inc. | System, method, and apparatus for preventing ransomware |
11722519, | Jun 24 2021 | AIRGAP NETWORKS INC. | System and method for dynamically avoiding double encryption of already encrypted traffic over point-to-point virtual private networks for lateral movement protection from ransomware |
11736520, | Jun 24 2021 | AIRGAP NETWORKS INC. | Rapid incidence agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links |
11757933, | Jun 24 2021 | AIRGAP NETWORKS INC. | System and method for agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links |
11757934, | Jun 24 2021 | AIRGAP NETWORKS INC. | Extended browser monitoring inbound connection requests for agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links |
11916957, | Jun 24 2021 | AIRGAP NETWORKS INC. | System and method for utilizing DHCP relay to police DHCP address assignment in ransomware protected network |
Patent | Priority | Assignee | Title |
11093139, | Jul 18 2019 | Pure Storage, Inc. | Durably storing data within a virtual storage system |
6914905, | Jun 16 2000 | ARISTA NETWORKS, INC | Method and system for VLAN aggregation |
8055800, | Jun 29 2007 | Extreme Networks, Inc | Enforcing host routing settings on a network device |
9602529, | Apr 02 2014 | The Boeing Company | Threat modeling and analysis |
20170149775, | |||
20210152595, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Jun 24 2021 | AIRGAP NETWORKS, INC. | (assignment on the face of the patent) | / | |||
Jun 24 2021 | AGRAWAL, RITESH R | AIRGAP NETWORKS, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 056688 | /0355 | |
Jun 24 2021 | ADAVI, VINAY | AIRGAP NETWORKS, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 056688 | /0355 | |
Jun 24 2021 | MOHAN, SATISH M | AIRGAP NETWORKS, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 056688 | /0355 |
Date | Maintenance Fee Events |
Jun 24 2021 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Jun 24 2021 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Jul 07 2021 | SMAL: Entity status set to Small. |
Jul 07 2021 | SMAL: Entity status set to Small. |
May 02 2024 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Date | Maintenance Schedule |
Nov 09 2024 | 4 years fee payment window open |
May 09 2025 | 6 months grace period start (w surcharge) |
Nov 09 2025 | patent expiry (for year 4) |
Nov 09 2027 | 2 years to revive unintentionally abandoned end. (for year 4) |
Nov 09 2028 | 8 years fee payment window open |
May 09 2029 | 6 months grace period start (w surcharge) |
Nov 09 2029 | patent expiry (for year 8) |
Nov 09 2031 | 2 years to revive unintentionally abandoned end. (for year 8) |
Nov 09 2032 | 12 years fee payment window open |
May 09 2033 | 6 months grace period start (w surcharge) |
Nov 09 2033 | patent expiry (for year 12) |
Nov 09 2035 | 2 years to revive unintentionally abandoned end. (for year 12) |